SAFETY SWITCHING MODULE AND METHOD FOR TESTING 
THE SWITCHING-OFF ABILITY OF A SWITCHING ELEMENT 
IN A SAFETY SWITCHING MODULE 



CROSSREFERENCES TO RELATED APPLICATIONS 
[0001] This application is a continuation of copending international application 
PCT/EP02/02840 filed on March 14, 2002 designating the U.S. and published in German 
language on November 28, 2002. The international application claims priority of German 
patent application DE 101 27 233.2 filed on May 22, 2001 . 

BACKGROUND OF THE INVENTION 

[0002] The present invention relates to a safety switching module for safely 
switching-off an electrical load, comprising a first and a second switching control device, a 
first and a second switching element, both being series-connected with each other and 
forming a first current path for supplying the load, whereby the first switching element can 
be controlled by the first switching control device and the second switching element can be 
controlled by the second switching control device, and an evaluation and control device for 
testing the switching-off ability of at least one switching element. The present invention 
further relates to a method for testing the switching-off ability of a switching element in such 
a safety switching module. 

[0003] Such safety switching modules and safety switching devices, respec- 
tively, are generally known. For example, the applicant offers safety switching devices of 
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different types under the name "PNOZ". In the patent application DE 100 11 211, the 
applicant has disclosed such a safety switching device, for example. 

[0004] In general, such safety switching devices are particularly used in the in- 
dustrial field as to switch on and safely switch off electrically driven machines, like a stamp- 
ing press or a milling cutter, a valve block for pneumatic or hydraulic control systems or 
output models of an SPS. Particularly in connection with a mechanically-operated emer- 
gency stop push button they serve to switch off the machine in an emergency situation 
quickly and safely. For this purpose, the energy supply of the machine to be switched off is 
coupled via two switching elements connected in series. As soon as just one of both 
switching elements opens, the energy supply to the machine is interrupted. 

[0005] In order to carry out a test of the switching ability of the switching ele- 
ment during operation of such a safety switching device, an evaluation and control unit is 
provided which switches off each single switching element briefly and which thereby detects 
and evaluates the output signal (back-read-out signal) of the switching elements. On the 
basis of this evaluation, the evaluation and control unit is able to determine whether each 
switching element has the ability to interrupt the electrical supply of the machine, i.e. in 
general the electrical load, in an emergency situation. In order not to effect the electrical 
load during this test procedure, the switching element is switched off just for a very brief 
time period which is not "viewable" for the load. 

[0006] Due to the mechanical inertia of the electromechanical switching ele- 
ments, this test procedure is possible only for electronic switching elements on the basis of 
semiconductor devices. If, however, the current to be switched by the switching element 
exceeds a predetermined value (typically about 8 ampere) and the electrical load is not a 
pure ohmic load (capacitive and inductive components), the above-mentioned test proce- 
dure consisting of the brief switching-off of the switching elements is only possible with a 
large additional effort. For evaluating the output signals of the switching elements, the load 
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would have to be discharged in this case as to keep the switching-off pulse small. The brief 
discharge of a larger capacitor would require a very large discharge current. For example, 
to discharge a 1 mF capacitor in a time period of 200 fjs by 25 V, a discharge current of 125 
A would be necessary. 

SUMMARY OF THE INVENTION 

[0007] In view of the above, the object of the present invention is to provide a 
safety switching module of the afore-mentioned kind which allows a test of the switching-off 
ability of the switching elements in a simple manner also with large currents to be switched 
and/or capacitive or inductive loads. 

[0008] This object is solved by the safety switching module of the afore- 
mentioned kind in that a third and a fourth switching element are provided which are 
connected to each other in series, are connected in parallel to the series connection 
consisting of said first and second switching elements, and form a second current path, the 
third switching element being controlled by the first switching control device and the fourth 
switching element being controlled by the second switching control device; and that the 
evaluation and control device carries out the test of the switching elements alternating in 
one of both current paths so that the other of both current paths supplies the load. 

[0009] That is with other words that in addition to the present current path which 
may be switched currentless by both switching elements, a further current path is provided 
in parallel having two further switching elements. In normal operation the load is energized 
via both current paths. During a test cycle, the switching-off ability of one of both current 
paths is tested while the other current patch then takes over the electrical supply soleley. 

[0010] Hence it is possible to still carry out a test of the switching-off ability by 
briefly switching-off the switching elements and by back-reading out output signals of these 
switching elements without impeding the supply of the electrical load. As a result, a safety 
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switching module for safely switching-off large currents as well may be constructed with 
simple means. 

[0011] Since the switching-off pulse does not reach the load, longer switching- 
off pulses are possible. I.e. that the arrangement according to the present invention allows 
to test semiconductor devices as well as electromechanical switching elements while the 
load is switched on. 

[0012] A further advantage of the inventive arrangement is that the energy sup- 
ply safety is increased since a safe supply of the load is possible even if one current path 
breaks down due to a short-circuited semiconductor device in response to a respective 
driving signal. 

[0013] In a preferred embodiment of the invention, the first and the second 
switching element are provided as semiconductor switching elements. Preferably, the 
second and the fourth switching elements are electromechanical switching elements, 
preferably relays. 

[0014] These measures have the advantage that, for example, the relay con- 
tacts need not switch the current in normal operation since the semiconductor switching 
element switches faster and has already switched off the current. This allows to take care of 
the relay contacts and to increase their operating life significantly. Due to the use of diversi- 
tary redundant switching elements (semiconductor and relay), failures in both switching 
elements caused by the same reasons, e.g. by a disturbing pulse with high energy, may be 
excluded. Of course it is also possible that all four switching elements are provided equally 
as semiconductor switching elements, AC current switching semiconductor switching 
elements, preferably photo-MOS-relays or relays. 

[0015] In a preferred embodiment, the switching control device is provided as a 
dual-channel switching control device. 
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[0016] This measure has the advantage that the safety of the safety switching 
module may be further increased. 

[0017] In a preferred embodiment, the evaluation and control device is con- 
nected with each of both current paths such that they may readout a signal between the 
first and the second switching element and the third and the fourth switching element, 
respectively. 

[0018] This measure has the advantage that the evaluation and control device 
is able to detect the switching-off ability of both switching elements in the respective current 
path. 

[0019] In a preferred embodiment, the evaluation and control device is provided 
such that it generates a short switching-off pulse and supplies it either to the first or to the 
third switching element as to switch off this element shortly. Preferably, this switching-off 
pulse is modulated on the control signal generated by the switching control device. 

[0020] This measure has the advantage that a very simple arrangement for test- 
ing the switching-off ability is possible. 

[0021] The object underlying the present invention is also solved by a method 
for testing the switching-off ability of a switching element in a safety switching module which 
serves to safely switch off an electric load, and which comprises the steps: providing a first 
current path for energizing the load, said first current path comprising a switching element 
for safely switching-off, providing a second current path in parallel to the first current path 
for energizing the load, the second current path comprising at least one switching element, 
and alternately testing the switching-off ability of one of both current paths, the other current 
path not being tested solely energizing said load during this test phase. 

[0022] This method for testing the switching-off ability has the same advantages 
as mentioned above, so that it is refrained from describing them again. 
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[0023] It is to be understood that the features mentioned above and those yet to 
be explained below can be used not only in the respective combinations indicated, but also 
in other combinations or in isolation, without leaving the scope of the present invention. 

BRIEF DESCRIPTION OF THE DRAWINGS 

[0024] Embodiments of the present invention are shown in the drawing and will 
be described in detail in the following description. In the drawings: 

[0025] Fig. 1A is a schematic view of a safety switching device according to a 
first embodiment; 

[0026] Fig. 1B is a schematic view of a safety switching device according to a 
second embodiment; 

[0027] Fig. 2 is a schematic interconnection diagram of the safety switching 
module according to the present invention in a single-pole implementation; and 

[0028] Fig. 3 is a schematic interconnection diagram of the safety switching 
module according to the present invention in a two-pole implementation. 

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS 
[0029] In Fig. 1A, a safety switching device is shown in a schematic presenta- 
tion and is indicated with reference numeral 10. The safety switching device 10 comprises a 
schematically indicated safe evaluation and control unit 12. This evaluation and control unit 
12 is arranged by using known components, as they are already used in the safety switch- 
ing device "PNOZ" of the applicant mentioned above. The object of this evaluation and 
control unit is to evaluate safely the switching signals supplied thereto, for example from an 
emergency stop push button 14, and to generate respective output signals. 

[0030] The evaluation and control unit 12 is arranged in the shown embodiment 
with two channels, both channels being indicated with reference numerals 16a and 16b. Of 



7 



course, it would also be possible to use other arrangements of the evaluation and control 
unit 12. For a more detailed description of such an evaluation and control unit 12, reference 
is made to the book "Maschinensicherheit", Winfried Graf, Huthig-Verlag, 1997. 

[0031] The safety switching device 10 further comprises a driver device (switch- 
ing control device) 20A and 20B, respectively, for each channel, each being supplied with a 
control signal from the respective evaluation and control unit 16a and 16b, respectively, via 
lines 22. Although in Fig. 1 A only one line is shown for the lines 22, the lines 22 may also 
be provided as multi-core bus lines. 

[0032] The driver device 20 generates driving signals in response to the sup- 
plied control signals of the evaluation and control unit 12, which driving signals are supplied 
to the switching elements 24.1 to 24.4. In Fig. 1 A it is shown that the driver device 20A 
generates two driving signals which are supplied to both switching elements 24.1 and 24.3. 
The driver device 20B also generates two driving signals, which are, however, supplied to 
both switching elements 24.2 and 24.4. Both driving signals generated by the driver devices 
20A and 20B, respectively, are equal so that during normal operation of the safety switching 
device, the switching element pairs 24.1 and 24.3, and 24.2 and 24.4, respectively, have 
the same switching state. 

[0033] According to the present invention, the four switching elements 24.1 to 
24.4 are all arranged such that two identical current paths 26.1 and 26.2 are formed. 
Particularly, both switching elements 24.1 and 24.2 are connected in series as to form the 
first current path 26.1, whereas the other two switching elements 24.3 and 24.4 are also 
connected in series and form the second current path 26.2. From the diagram in Fig. 1 A it is 
apparent that both current paths 26.1, 26.2 are parallel to each other. Both current paths 
26.1, 26.2 couple an input terminal 30 of the safety switching device 10 with an output 
terminal 33. When the switching elements 24 are switched on, an ohmic connection be- 
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tween the input terminal 30 and the output terminal 33 is provided so that a respective 
current may flow via both current paths 26. 

[0034] Beside the output terminal 33, the safety switching device 10 comprises 
a further output terminal 35 and a further input terminal 37. From Fig. 1 A it is apparent that 
an electrical connection is formed between the input terminal 37 and the output terminal 35. 

[0035] In operation, a DC voltage source 41 is coupled with both input terminals 
30, 37 and provides, for example, a voltage of 24 volt between both terminals 30, 37, the 
input terminal 30 having a positive potential and the input terminal 37 having a reference 
potential, for example 0 volt. 

[0036] The load to be switched by the safety switching device 10 is schemati- 
cally shown in Fig. 1 A and indicated with reference numeral 43. In the present embodiment, 
it is a high power load, for example a valve block for pneumatic or hydraulic control sys- 
tems, or an output module of an SPS control system, which requires a current greater than 
8 ampere. The load 43 is coupled between the output terminals 33 and 35. As a conse- 
quence, there is a current flow from the DC voltage source 41 via the input terminal 30, 
both current paths 26.1, 26.2, the output terminal 33, the load 43, the output terminal 35 
and the input terminal 37 back to the DC voltage source 41 when the switching elements 24 
are switched on. If, for example, the emergency stop push button switch 14 is actuated, the 
evaluation and control unit 12 generates control signals which are converted into respective 
driving signals by both driver devices 20A, 20B. These driving signals cause the switching 
elements 24 to switch off as to switch both current paths 26.1 , 26.2 currentless. As a result, 
the load 43 is isolated from the DC voltage source 41 . 

[0037] This kind of safety switching devices 10 requires that the switching-off 
ability of the switching elements 24 is tested periodically. For this purpose, a signal is 
picked off between both switching elements 24.1 and 24.2 of the first current path 26.1 and 
between both switching elements 24.3 and 24.4 of the second current path and is supplied 



to the evaluation and control unit 12. In Fig. 1A this is shown by means of two arrows 
indicated with reference numeral 45. 

[0038] The switching-off ability of the switching elements is now tested by 
switching-off both switching elements in one current path for a short period, while the 
switching state of the switching elements in the other current path is maintained. The short 
switching-off of the switching elements in one current path results in a change of potential 
between both tested switching elements provided that the switching elements are faultless. 
The change of potential may be detected by the evaluation and control unit 12 and may be 
evaluated respectively. In the event that, for example, the switching element 24.1 in the first 
current path 26.1 cannot be opened any more, the potential remains unchanged during the 
short test phase, and the evaluation and control unit 12 may detect this as failure. An 
immediate switching-off of the whole safety switching device and, hence, of the load 43 
would be the consequence thereof. 

[0039] By providing two current paths 26.1, 26.2, only one of which being 
tested, a constant energy supply of the load 43 also during the test phase is guaranteed. 
Hence, the safety switching device 10 allows to test the switching-off ability of switching 
elements although very large currents flow. Moreover, it is not of importance whether the 
load 43 is a pure ohmic load or, for example, a capacitive load. 

[0040] Fig. 1A further shows connections in broken lines running from both 
evaluation and control units 16A, B to the driver devices 20A, B and from the back-readout 
lines to the evaluation and control units 16A, B. These connections serve to take the two- 
channel structure of the safety switching device up again; these connections enable each 
evaluation and control unit 16A, B to drive and to test all four switching elements 24.1 - 
24.4. 

[0041] In Fig. 1 B, a safety switching device 10' is shown, the function of which is 
equal to said of the safety switching device 10 already described with reference to Fig. 1 A. 
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It is, therefore, refrained from a detailed description thereof at this point. Also the construc- 
tive arrangement of the safety switching device 10' does not differ from said of the safety 
switching device 10. The only difference is that the safety switching device 10' is divided 
into two modules 50, 51 . The module 50 which is indicated as safety switching module in 
the following comprises the driver devices 20A, 20B as well as the switching elements 24 
which are provided in both current paths 26.1, 26.2. The module 51, which is referred to as 
evaluation and control module in the following, comprises the evaluation and control unit 
12, the control signals of which may be supplied to input terminals 53 of the safety switch- 
ing module 50. By dividing the safety switching device 10' in two single modules 50, 51 , the 
flexibility may be increased. Particularly, the safety switching module 50 may be coupled to 
already existing safety switching devices as an additional module for switching large 
currents. 

[0042] With reference to Fig. 2 a specific preferred embodiment of the safety 
switching module 50 will be shown in the following. However, it is to be noted at this point 
that the circuit arrangement shown is purely illustrative. For achieving the functions de- 
scribed with reference to Fig. 1 A, different circuit arrangements are also conceivable. 

[0043] For the sake of simplification, in Fig. 2 like parts are indicated with like 
reference numerals, so that it may be refrained from describing these parts again. 

[0044] The single function blocks, namely both driver devices 20A, 20B as well 
as the switching elements 24.1 through 24.4, are shown in broken lines. 

[0045] In the present embodiment, the driver device 20A comprises two driver 
units 61 , 62, each generating an output signal in response to respective input signals, the 
output signals are supplied to a respective opto-coupler 63 and 64, respectively. The 
outputs of both opto-couplers 63, 64 are connected in series and serve to drive the switch- 
ing element 24.1. For this purpose, the control input of the switching element 24.1 is 
coupled with a positive potential via the outputs of the opto-couplers 63, 64. If respective 
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control signals are supplied to the inputs of both opto-couplers 63, 64, the outputs of both 
opto-couplers are connected with each other, so that the switching element 24.1 receives a 
driving signal having positive potential and closes in response thereto. This is the normal 
operation mode of the safety switching module 50 as to energize the load 43. 

[0046] In the present embodiment, the switching element 24.1 is a semiconduc- 
tor switching element, preferably a field effect transistor 71 . 

[0047] In contrast thereto, the second switching element 24.2 in the same cur- 
rent path 26.1 is provided as an electromechanical switching element, preferably a relay 73. 
This relay 73 is driven by respective driver units 61 , 62. Since the relay 73 provides a 
galvanic isolation to the driver device 20B itself, the use of opto-couplers 63, 64 may be 
avoided. 

[0048] In both cases, however, it is to be noted that the activation or drive of the 
field effect transistor 71 and the relay 73, respectively, is carried out with two channels. 
Only if both driver units 61, 62 generate a respective driving signal, the switching element 
24.1 ,24.2 is closed. 

[0049] The evaluation and control unit 12 tests the switching-off ability of the 
switching element 24 by briefly switching-off the switching element of the current path. 

[0050] For testing the switching-off ability of the FET 71 and the contact 73, a 
signal is picked off between both switching elements 24.1, 24.2 and is supplied via the line 
45 to the opto-coupler 83. This opto-coupler 83 generates a back-readout signal, which is 
supplied to the evaluation and control unit 12. This back-readout signal informs whether the 
FET 71 and the contact 73 switch off during the test phase. If both switching elements 71 
and 73 do this, the safety is guaranteed; if not, the FET 71 or the contact 73 are faulty with 
the result that the whole safety switching module 50 has to be switched off so that the load 
43 is brought into a safe state. 
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[0051] The arrangement of the second current path 26.2 exactly corresponds to 
that of the current path 26.1 , so that it is refrained from a repetition of the description at this 
point. For the sake of better understanding, some elements are integrated into one function 
block, for example both driver units 61, 62 and the clock generator 81 . Also in the second 
current path 26.2, the switching-off ability of the FET 71 and the contact 24.2 is carried out 
by modulating a short switching-off pulse on the driving signal. By means of an opto-coupler 
83, the respective back-readout signal is generated. 

[0052] Essential to the realization of the tests of the switching elements is that 
always only one current path is tested, so that the respective other current path may 
guarantee a respective uninterrupted energy supply of the load 43 also during the test 
phase. 

[0053] In the embodiment shown in Fig. 2, the switching elements of a current 
path are formed diversitary redundant. Therewith, failures in one current path due to the 
same reasons may be excluded. Of course, beside this preferred embodiment it is also 
possible to use also equal switching elements in a current path, particularly semiconductor 
switching elements or electromechanical switching elements. 

[0054] A further embodiment of a safety switching module is shown in Fig. 3 
and indicated with reference numeral 50'. The difference to the safety switching module 50 
shown in Fig. 2 is that it is a two-pole embodiment of a safety switching module. I.e. the 
load 43 lies between two safety switching modules 50, as shown in Fig. 2. The connection 
between the terminal 35 and the terminal 37 is, hence, not made directly but also via two 
current paths 26.3 and 26.4, which are structured in a reversed arrangement compared to 
both current paths 26.1 and 26.2. The function, however, corresponds to that of the safety 
switching module 50 as shown in Fig. 2 and described with reference thereto, so that it is 
refrained from describing it again. 
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[0055] The advantage is that the load can be switched-off safely also in the 
event of a 24 volt short circuit. 

[0056] To sum up, it is to be noted that the inventive provision of two current 
paths which are tested alternately may also allow the switching of large currents without 
having to refrain from a test of the switching-off ability of the switching elements, or without 
having to provide complicated test circuits which have to be adapted eventually to the 
respective load. 

[0057] By means of the inventive circuit arrangement, interruptions of the 
switching elements are possible which last longer than the switching-off response time of 
the load. As a result, the test of relays during operation is also possible. 



